Country: Canada. Score: Rank: 9/24

Transcription

1 Score: Rank: 9/24 Canada is a world leader in ICT adoption and innovation and has played a leading role in the development of international standards. It has a strong commitment to free trade and interoperability. Canada also has very strong privacy and e-commerce laws, although no modern cybercrime laws are in place. In 2012 Canada finally passed new copyright laws (at the fourth attempt). These laws provide appropriate protection for online material and will allow Canada to ratify the WIPO Copyright Treaty. This development is the major change between the 2012 and 2013 reports in Canada. Although Canada does not have a cohesive and funded National Broadband Plan in place, the existing level of broadband penetration is quite high and the country continues to improve broadband access in regional areas. Canada s updated IP laws and improved infrastructure helped improve its ranking by three spots to 9th place in the 2013 Scorecard. DATA PRIVACY 1. Are there laws or regulations 4 Personal Information Protection and Electronic Documents Act (PIPEDA) governing the collection, use, or other processing of personal information? 2. What is the scope and coverage of privacy law? Comprehensive Canada has national data protection legislation covering both the public and private sectors. Provincial legislation is also in place in some jurisdictions. 3. Is the privacy law compatible with the Privacy Principles in the EU Data Protection Directive? 4. Is the privacy law compatible with the Privacy Principles in the APEC Privacy Framework? 5. Is an independent private right of action available for breaches of data privacy? 6. Is there an effective agency (or regulator) tasked with the enforcement of privacy laws? 7. What is the nature of the privacy regulator? 8. Are data controllers free from registration requirements? 9. Are cross-border transfers free from registration requirements? 4 Canadian privacy legislation has been formally assessed as adequate by the EU, meaning that personal information can be transferred from EU members to Canada without further measures to ensure the data are protected (e.g., contractual arrangements). Canadian privacy law is very similar to the EU Directive. 4 Canada is a member of APEC, and its legislation is compatible with the APEC privacy principles. Canada is an active participant in several APEC privacy initiatives and the Office of the Privacy Commissioner of Canada (OPCC) is a member of the APEC Cross-border Privacy Enforcement Arrangement (CPEA). < Committee-on-Trade-and-Investment/Electronic-Commerce-Steering-Group/Crossborder-Privacy-Enforcement-Arrangement.aspx> Available The privacy legislation in Canada is principally based on complaints to the commissioner, which will usually be settled through a dispute resolution process. However, individuals have a right to pursue matters to the federal court, which can make a range of orders including compensation (under Section 11, PIPEDA). National regulator OPCC < acts as the national regulator. Several other privacy regulators have been established at the provincial level. Sole OPCC is an independent regulatory office built around a single commissioner. commissioner 4 There are no registration requirements under Canadian privacy legislation. 4 Canadian businesses do not need to register their cross-border transfers. However, there are specific rules, in the PIPEDA applying to the cross-border transfer of data. These rules require businesses to ensure that data will be subject to comparable protection in the target country. The commissioner has published Guidelines for Processing Personal Data Across Borders (January 2009) to assist businesses meet these obligations. < BSA Global Cloud Computing Scorecard 1

2 10. Is there a breach notification law? 6 Currently, Canada does not have national mandatory breach notification requirements in place. An amendment to the PIPEDA to introduce such requirements is stalled in Parliament. In the meantime, the commissioner has issued voluntary Guidelines for Organizations in Responding to Privacy Breaches (August 2007). < information/guide/2007/gl_070801_02_e.cfm> One province in Canada (Alberta) has local mandatory breach requirements in place. SECURITY 1. Is there a law or regulation that gives electronic signatures clear legal weight? 2. Are ISPs and content service providers free from mandatory filtering or censoring? 3. Are there laws or enforceable codes containing general security requirements for digital data hosting and cloud service providers? 4. Are there laws or enforceable codes containing specific security audit requirements for digital data hosting and cloud service providers? 5. Are there security laws and regulations requiring specific certifications for technology products? CYBERCRIME 4 Canada has adopted some broad provisions relating to electronic signatures, based on the UN Model Law on E-Commerce. The Canadian Uniform Electronic Commerce Act (UECA) 1999 implements electronic signature provisions across all provinces and territories of Canada and the federal government. The Secure Electronic Signature Regulations 2005 establish some additional rules for digital signatures. 4 Internet content is not censored in Canada, although some specific local laws may apply to online content (e.g., race hate sites). A voluntary filtering service is available from most ISPs to filter out a small list of child pornography sites. None Canada has not yet issued any formal guidelines, standards, or regulations regarding cloud computing security. However, Canadian organizations may be influenced by relevant standards being developed by the National Institute of Standards and Technology (NIST) in the United States. Limited coverage in legislation Comprehensive requirements (including common criteria) Government agencies in Canada are covered by a range of laws, policies, standards, and guidelines relating to information security. These are set out at < sim-gsi/pc-cd/documents/dev-ela-eng.asp>. However, they do not yet include specific guidance or rules on audits for cloud computing or digital data hosting. For example, the Policy on Government Security allows the secretary of the Treasury Board to order a security audit in limited circumstances and requires agencies to develop internal audit plans. < aspx?id=16578&section=text> The private sector is subject to limited security requirements in relevant privacy legislation. However, these security requirements are very generic, and there are no customized audit rules for cloud computing. Canada is a Certificate Authorizing Member of the Common Criteria Recognition Agreement (CCRA) < and it is typical, although not always mandatory, for government procurement requirements to include certification against the Common Criteria. 1. Are cybercrime laws in place? Canada has comprehensive computer crime laws in place that will apply to most cybercrimes. However, there are well recognized limitations in Canada s laws relating to a lack of online investigation and enforcement tools 2. Are cybercrime laws consistent with the Budapest Convention on Cybercrime? 3. What access do law enforcement authorities have to encrypted data held or transmitted by data hosting providers, carriers, or other service providers? 4. How does the law deal with extraterritorial offenses? INTELLECTUAL PROPERTY RIGHTS 1. Is the country a member of the TRIPS Agreement? 2. Have IP laws been enacted to implement TRIPS? Access with a warrant Limited coverage Canada signed the Cybercrime Convention in However, Canada is yet to ratify the Convention due to limitations in the computer crime legislation relating to enforcement tools to allow the government to investigate, monitor, search and seize relevant electronic data. A bill to address this issue is now before Parliament (Bill C-30). Law enforcement agencies in Canada can seek a warrant to access encrypted data. The exact circumstances in which such a warrant will be granted remain unclear, and requests are understood to be rare. Bill C-30 is designed to clarify the situations in which law enforcement can gain access to electronic data. Canada s computer crime provisions are contained in the Criminal Code. Section E of the code sets out the jurisdiction of the courts. There are very limited circumstances under which the code could be enforced against a person outside Canada; generally the person would have to be a Canadian citizen. Some more specific crimes against the national interest have a broader extraterritorial application. Canada is attempting to update its cybercrime investigation and enforcement powers in order to ratify the Convention on Cybercrime, but this legislation (also Bill C-30) has not yet been passed. 4 Canada became a member of the TRIPS Agreement in Canada had implemented the provisions of the TRIPS Agreement in local laws by BSA Global Cloud Computing Scorecard 2

3 3. Is the country party to the WIPO Copyright Treaty? 4. Have laws implementing the WIPO Copyright Treaty been enacted? 5. Are civil sanctions available for unauthorized making available (posting) of copyright holders works on the Internet? 6. Are criminal sanctions available for unauthorized making available (posting) of copyright holders works on the Internet? 7. Are there laws governing ISP liability for content that infringes copyright? 8. Is there a basis for ISPs to be held liable for content that infringes copyright found on their sites or systems? 9. What sanctions are available for ISP liability for copyright infringing content found on their site or system? 10. Must ISPs take down content that infringes copyright, upon notification by the right holder? 11. Are ISPs required to inform subscribers upon receiving a notification that the subscriber is using the ISP s service to distribute content that infringes copyright? 12. Is there clear legal protection against misappropriation of cloud computing services, including effective enforcement? Canada signed the WIPO Copyright Treaty in However, it has not been ratified. Ratification is expected in the near future. 4 Although Canada is yet to ratify the WIPO Copyright Treaty, the enactment of the Copyright Modernization Act (CMA) in 2012 updates Canadian law to comply with the treaty, and anticipates ratification of the treaty <balancedcopyright.gc.ca>. 4 Canada is updating its copyright legislation to clarify the rules relating to Internet content. The CMA has a staggered time frame for implementation <balancedcopyright. gc.ca>. Civil sanctions for the unauthorized making available of copyright material have been clarified and strengthened. The criminal sanctions in the Copyright Act (Sections 42 and 43) apply in limited circumstances. Generally, the individual would have to make the infringing copy available for sale before the criminal sanctions would apply. 4 ISP liability has been clarified and strengthened by the CMA <balancedcopyright. gc.ca>. 4 ISPs may be found liable for hosting infringing content, subject to the detailed and strict requirements of the CMA <balancedcopyright.gc.ca>. Civil The CMA includes some relevant civil sanctions <balancedcopyright.gc.ca>. 6 The CMA does not include a take-down system; it includes only a notice and penalty system. 4 The CMA includes a provision requiring notices to be forwarded to subscribers. Comprehensive protection Canada s IP laws have recently been updated to provide clear protection for cloud computing. However, the CMA laws <balancedcopyright.gc.ca> are new and have not yet been tested in practice. Canada s computer crime laws also provide a useful layer of protection for criminal misappropriation of cloud services. Support for Industry-Led Standards & INTERNATIONAL HARMONIZATION OF RULES 1. Are there laws, regulations or policies that establish a standards-setting framework for interoperability and portability of data? 2. Is there a regulatory body responsible for standards development for the country? 4 Canada has a strong and well-established framework for standards setting. While some national standards have been developed in specific areas of data interoperability, Canada generally participates in discussions relating to global standards for datarelated issues. 4 The Canadian Standards Association < is responsible for standard setting and management. 3. Are e-commerce laws in place? 4 The Canadian Uniform Electronic Commerce Act (UECA) What international instruments are the e-commerce laws based on? 5. Is the downloading of applications or digital data from foreign cloud service providers free from tariff or other trade barriers? 6. Are international standards favored over domestic standards? UNCITRAL Model Law on E-Commerce The Canadian legislation is based on the UN Model Law on E-Commerce. Canada has also been actively engaged in the development of the UN Convention on Electronic Contracting. However, Canada has not yet signed the Convention because of concerns over the differences between local legislation and the Convention regarding electronic signatures. 4 Canada has not imposed any tariffs or trade-related barriers on digital data or cloudrelated services. 4 Canada uses a mix of domestic and international standards in the digital economy sector BSA Global Cloud Computing Scorecard 3

4 7. Does the government participate 4 Canada is an active participant in international standards-setting processes. in international standards-setting process? PROMOTING FREE TRADE 1. Are any laws or policies in place that implement technology neutrality in government? 2. Are cloud computing services able to operate free from laws or policies that mandate the use of certain products (including, but not limited to, types of software), services, standards, or technologies? 3. Are cloud computing services able to operate free from laws or policies that establish preferences for certain products (including, but not limited to, types of software), services, standards, or technologies? 4. Are cloud computing services able to operate free from laws that discriminate based on the nationality of the vendor, developer, or service provider? ICT READINESS, BROADBAND DEPLOYMENT 1. Is there a national broadband plan? By 2016, all Canadians to have access to broadband speeds of at least 5 megabits per second (Mbps) for downloads and 1 Mbps for uploads 2. Are there laws or policies that regulate the establishment of different service levels for data transmission based on the nature of data transmitted? 4 Canada is a signatory to the APEC Technology Choice Principles (2006), under which each of the member economies agreed to promote technology neutral policies and regulations that allow flexibility in the choice of technologies in order to ensure competition, maximize benefits for governments, businesses, and consumers, and bridge the development gap. Canada has implemented these commitments in several key government policies, including procurement policy. 4 Canada has an open, transparent and non-discriminatory approach to public procurement, and there are no other restrictions or requirements for the use of mandatory technologies relevant to cloud computing. 4 There are no preferences in place for any products or services relevant to cloud computing. 4 Canada has a non-discriminatory policy in place for procurement, with only a few minor exceptions relating to defense and national security. Some limited domestic preferences also appear in regional and provincial tenders. Canada is a member of the WTO plurilateral Agreement on Government Procurement. Multiple regulations and extensive public debate Canada does not have a cohesive and funded National Broadband Plan. In May 2011, the Canadian Radio-television and Telecommunications Commission (CRTC) < gc.ca> set a target for broadband Internet access services across Canada. By the end of 2015, the CRTC expects all Canadians to have access to broadband speeds of at least 5 megabits per second (Mbps) for downloads and 1 Mbps for uploads. Canada lays claim to one of the first policy frameworks that specifically enshrines (and, controversially, sets boundaries) on net neutrality. This was established in the November 2009 CRTC Telecom Regulatory Policy (CRTC ) < The CRTC has been criticized in its enforcement of the net neutrality policy framework, with claims that most Canadian ISPs have been the subject of complaints with minimal consequences. There have not been any compulsory audits or fines imposed < content/view/5918/159>. 3. Base Indicators 3.1. Population 34,349,561 In 2011, the population of Canada increased by 1% Urban Population (%) 81% [United Nations, Department of Economic and Social Affairs, Population Division (2012). World Urbanization Prospects: The 2011 Revision, <esa.un.org/unup/cd-rom/ Urban-Rural-Population.htm>] 3.3. Number of Households 13,125,000 In 2011, the number of households in Canada increased by 1.7% Population Density (people per square km) (2010) 4 [World Bank, Data Catalog, Indicators, Population Density (2012) <data.worldbank.org/ indicator/en.pop.dnst>] 2013 BSA Global Cloud Computing Scorecard 4

5 3.5. Per Capita GDP (US$ 2011) $50,345 In 2011, the per capita GDP for Canada increased by 2.5% to US$50, Public Cloud Services Market Value (Billions of US$) 3.7. Personal Computers (% of households) 4. ICT and Network Readiness Indicators 4.1. ITU ICT Development Index (IDI) (Score is out of 10) 4.2. World Economic Forum Networked Readiness Index (NRI) (2012) (Score is out of 7) 4.3. International Connectivity Score (Score is out of 10) 4.4. IT Industry Competitiveness Index (Score is out of 100) 5. Internet Users and International Bandwidth 5.1. Internet Users 28,510,136 [calculated from and ] 5.2. Internet Users as % of Population 5.3. International Internet Bandwidth (bits per second per Internet user) [World Bank, Data Catalog, Indicators: GDP per capita, current US$ (2012) <data. worldbank.org/indicator/ny.gdp.pcap.cd> and GDP growth, annual % (2012) <data. worldbank.org/indicator/ny.gdp.mktp.kd.zg>] 3.41 Gartner has calculated the value of the public cloud services market in Canada in 2011 to be US$3.41 billion. This is a 30% increase from 2010 and ranks Canada 5 (out of 20 countries) in the forecast. Gartner has projected the five-year compound annual growth rate (CAGR) to 2016 to be 19.6%, and this ranks Canada 10 (out of 20 countries) for growth in the value of the market for public cloud services to [Gartner, Forecast Overview: Public Cloud Services, Worldwide, (August 2012 Update) < 86% In 2011, 86% of households in Canada had personal computers. This is a 2.6% increase since 2010 and ranks Canada 14 out of 182 countries surveyed. The growth from 2010 is below the five-year CAGR from 2006 to 2011 of 2.7%. Database (Dec 2012) < Indicators Database may update this indicator for prior years Canada s ITU ICT Development Index (IDI) for 2011 is 7.04 (out of 10), resulting in a rank of 22 (out of 161 economies). The 2011 IDI for Canada has increased by 2.5%, and the IDI ranking has declined by two places from a rank of 20 since [International Telecommunication Union (ITU), Measuring the Information Society (2012) < Indicators Database may adjust this indicator, both for 2011 and prior years Canada has a Networked Readiness Index (NRI) score of 5.33 (out of 7), resulting in a rank of 12 (out of 142 economies) and a rank of 12 (out of 47) in the high income grouping of economies. The 2012 NRI for Canada has increased by 2.3% and declined from a rank of 8 since [World Economic Forum, Global Information Technology Report (2012) <www. networkedreadiness.com/gitr>] 6.88 Canada has a Connectivity Score of 6.88 (out of 10), resulting in a rank of 8 (out of 25) in the innovation-driven grouping of countries/economies. [Nokia Siemens, Connectivity Scorecard < Canada has an IT Industry Competitiveness Index Score of 67.6 (out of 100), resulting in a rank of 7 (out of 66 countries/economies included in the index). The 2011 index score is a 4.2% decrease on the 2009 score. Canada has moved down the ranking by three places since [Business Software Alliance (BSA) / Economist Intelligence Unit (EIU), IT Industry Competitiveness Index <globalindex11.bsa.org>] 83% In 2011, 83% of the population in Canada used the Internet, resulting in a ranking of 16 out of 199 countries surveyed. This is a 3.4% increase since The growth from 2010 is above the five-year CAGR from 2006 to 2011 of 2.8%. Database (December 2012) < Note: There may be some variations as to how countries calculate this. Some countries base this upon all or part of the population, such as between 16 and 72 years of age. Indicators Database may adjust this indicator, both for 2011 and for prior years. 70,150 Canada s International Internet Bandwidth (per Internet user) has increased by 28% since [International Telecommunication Union (ITU), Measuring the Information Society (2012) < BSA Global Cloud Computing Scorecard 5

6 5.4. International Internet Bandwidth (total gigabits per second [Gbps] per country) 6. Fixed Broadband 6.1. Fixed Broadband Subscriptions 6.2. Fixed Broadband Subscriptions as % of Households 6.3. Fixed Broadband Subscriptions as % of Population 6.4. Fixed Broadband Subscriptions as % of Internet Users 7. Mobile Broadband 7.1. Mobile Cellular Subscriptions 2,000 Canada has increased its International Internet Bandwidth by 33% since 2010 to 2,000 Gbps and is ranked 13 out of 188 countries surveyed. The growth from 2010 is below the five-year CAGR from 2006 to 2011 of 40.3%. 10,931,877 Canada has increased the number of fixed broadband subscribers by 4% since 2010 to, 10,931,877, and is ranked 14 out of 182 countries surveyed. The growth from 2010 is below the five-year CAGR from 2006 to 2011 of 6.3%. Indicators Database may adjust this indicator, both for 2011 and prior years. 83% [calculated from and ] Note: This may be skewed by business usage in some countries (refer to OECD comments about this). 32% Canada has increased its fixed broadband subscriptions (as a share of the population) by 3% since 2010, which is below the five-year CAGR from 2006 to 2011 of 5.2%. This ranks Canada 14 out of 187 countries surveyed. The OECD figures below present a breakdown on the type of fixed broadband connections in Canada. Canada is distinguished by having a higher proportion of cable broadband connections than any other OECD country. In the OECD, during 2011, Canada was ranked 13 (out of 34) for fixed (wired) broadband subscribers as a percentage of population [OECD Broadband Subscribers (Dec 2011) < DSL: 13.8% Cable: 17.8% Fiber/LAN: 0.4% Total: 32% (10,931,877 subscriptions). The OECD average total for 2011 was 25.6%. Canada s fixed broadband growth for 2011 was 4.3% (ranked 19 out of 34 for growth), above the OECD average growth of 4.1%. Note: There may be minor variations in the ITU and OECD subscriber totals due to definition, timing or population baseline differences. Database (July 2011) < 38% [calculated from and 8.6.1] 27,387,200 In 2011, Canada increased the number of mobile cellular subscriptions by 6% and is ranked 37 out of 195 countries surveyed. The number of subscriptions account for 80% of the population. Note: This figure may be inflated due to multiple subscriptions per head of population but excludes dedicated mobile broadband devices (such as 3G data cards and tablets) BSA Global Cloud Computing Scorecard 6

7 7.2. Active Mobile Broadband Subscriptions per 100 inhabitants 7.3. Number of Active Mobile Broadband Subscriptions 38% Canada has increased the number of active mobile broadband subscriptions (as a share of the population) by 30% since This ranks Canada 33 out of 144 countries surveyed. The OECD figures below present a breakdown on the type of mobile broadband connections in Canada. For 2011, Canada s OECD rank has declined one place and was 24th (out of 34) for mobile wireless broadband subscribers as a percentage of population [OECD Broadband Subscribers (Dec 2011) < Satellite: 0% Terrestrial fixed wireless: 1% Standard mobile broadband subscription: 35.2% (up from 26.6% in 2010) Dedicated mobile data subscriptions: 3.5% (up from 2.8%) Total: 39.7% (13,531,360 subscriptions). The OECD average total for 2011 was 54.3%. Canada s wireless broadband growth for 2011 was 30.6% (ranked 19 out of 34 for growth), marginally above the OECD average growth of 30.5%. Note: The mobile broadband subscription types were first reported by OECD in 2010, and ITU data is beginning to have this granularity. Note: The OECD figures include mobile data subscriptions, which are not as consistently reported in the ITU indicators. Note: This refers to the sum of standard mobile-broadband and dedicated mobilebroadband subscriptions to the public Internet. It covers actual subscribers, not potential subscribers, even though the latter may have broadband-enabled handsets. Indicators Database may adjust this indicator, both for 2011 and for prior years. 13,188,757 In 2011, Canada has increased the number of active mobile broadband subscriptions by 32% and is ranked 33 out of 145 countries surveyed BSA Global Cloud Computing Scorecard 7